For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) meeting NIST password guidelines and TOTP MFA should be more than enough.


SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor.

And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor.

And if your assessor is 4 years behind in their understanding of best practices in this area, then perhaps you need to find a new assessor ...

  • 15
    Password Rotation is one of the worst ideas that people still think is legitimately useful. I can't even count how often I have seen <month><year> as password. Or <password><number> which keeps incrementing by one every few months.
    – MechMK1
    Apr 14 '20 at 12:42
  • 3
    @MechMK1 if the password is automatically generated and submitted, it's actually a great idea. I mean, products exist that change passwords for accounts just after the password is used. It has its place, but just not with people.
    – schroeder
    Apr 14 '20 at 15:08
  • 8
    @MechMK1 at my first job we required rotation. My password was Password1, Password2, Password3..., Password9, Password1. Then I realized that you could change your password as frequently as you liked, so every 60 days I ran a Python script that changed my password 9 times. Apr 14 '20 at 15:54
  • 4
    our proxy (squid) also used basic authentication over http, so I treated my password as public knowledge. Apr 14 '20 at 15:55
  • 2
    @MechMK1 But <password><number> is a wonderful way to keep track of how long you have been at the company!
    – JiK
    Apr 15 '20 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.